CVE-2024-9648 is a CWE-434 vulnerability in the WP_Ulike_Pro_File_Uploader class of the WP ULike Pro WordPress plugin. It allows unauthenticated attackers to upload files with dangerous extensions due to insufficient validation of file types in all versions up to and including 1.9.3. This can lead to limited arbitrary file uploads that may be leveraged for attacks such as Cross-Site Scripting. The earliest confirmed patched version is 1.9.4.

Successful exploitation allows unauthenticated attackers to upload files with potentially dangerous extensions to the affected WordPress site. This can lead to limited arbitrary file upload scenarios, increasing the risk of Cross-Site Scripting and other attacks that rely on malicious file execution or content injection. The vulnerability does not directly allow full remote code execution but can be a stepping stone for further compromise.

Upgrade WP ULike Pro to version 1.9.4 or later, where this vulnerability is patched. No other official mitigations are documented. Patch status is confirmed by the vendor's versioning information. Users should verify they are not running versions up to 1.9.3 to avoid exposure.